CWE-777 · Input Validation and Logic
Regular Expression without Anchors
6CVEs
SortMost likely exploited
6 CVEs with CWE-777 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-22068Apache Traffic Server: Regex mappings match with malicious domain namesApache Software Foundation · Apache Traffic Server · CVSS 8.2 · 2026-07-29 | 8.2 | 0.6% | 2026-07-29 |
| CVE-2026-56021Webmin information disclosure via regex patternWebmin · Webmin · CVSS 5.3 · 2026-06-18 | 5.3 | 0.5% | 2026-06-18 |
| CVE-2026-78191WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pagesWebDyne · CVSS 9.8 · 2026-10-31 | 9.8 | 0.5% | 2026-10-31 |
| CVE-2026-40110jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_patjupyter-server · jupyter_server · CVSS 7.1 · 2026-05-05 | 7.1 | 0.3% | 2026-05-05 |
| CVE-2026-39087ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.ntfy · ntfy · CVSS 6.4 · 2026-04-23 | 6.4 | 0.3% | 2026-04-23 |
| CVE-2026-97736tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.tinyauth · tinyauth · CVSS 5.4 · 2026-09-25 | 5.4 | 0.2% | 2026-09-25 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.